synthetix[.]perps[.]bond

Analysis of synthetix.perps.bond shows a recently registered domain (created 21 Feb 2026) that is currently offline but was previously flagged by multiple security services. The domain resolves to IP 188.114.96.3, an address owned by Cloudflare (AS13335) located in the United States. DNS is served by two Cloudflare‑managed name servers (maciej.ns.cloudflare.com, saanvi.ns.cloudflare.com), indicating the infrastructure is fully proxied through Cloudflare’s edge network. The site presented a page title of “Synthetix” and is classified as a brand‑impersonation campaign targeting the Synthetix platform.

The SSL certificate was issued by Google Trust Services under the “WE1” profile, which is typical for Cloudflare‑protected sites and does not, by itself, indicate malicious intent. Detection services have recorded five positive detections out of ninety‑three VirusTotal scanners, and the domain appears on at least one public blocklist. PhishDestroy has actively blocked the domain, confirming that it was being used for malicious purposes. The registrar listed is NiceNIC International Group Co., Limited, a common registrar for short‑lived malicious domains.

The presence of Cloudflare Browser Insights and HTTP/3 suggests the site leveraged modern web protocols, possibly to improve performance or evade simple detection. Because the site is now taken offline, active traffic cannot be observed, and the exact payload (e.g., credential‑stealing pages) remains unknown. Defenders should continue to block the IP address 188.114.96.3 at network perimeters, add the domain to URL filtering lists, and monitor for any re‑registration of synthetix.perps.bond or similar sub‑domains under the same registrar. Threat intelligence feeds should be updated to reflect the elevated risk rating, and any user reports of unsolicited communications referencing Synthetix should be investigated for possible links to this infrastructure.